DeFi's lending exceeds $100 billion, and S & P wants to assess its risks

Deposits in online lending treasury exceeded US$10 billion. Standard & Poor's Global launched its exclusive risk assessment framework

S&P Global Ratings recently released a risk assessment system specially designed for online lending treasury. The framework not only evaluates the security of smart contract code, but also examines the operational capabilities of human managers. It is worth noting that the highest score in this system is not equivalent to the AAA credit rating in the traditional financial sector.

According to S & P Global Ratings's own data, deposits in this segment of decentralized finance (DeFi) have surged from approximately US$15 billion in September 2024 to US$10 billion in September 2026. The 567% increase in the past two years is certainly eye-catching, but the more critical issue lies in the direction of the funds. Savers are handing over capital to professional institutions, which determine collateral types, set risk exposure limits and allocate funds between different lending markets. This model allows an industry that aims to eliminate financial intermediation to rely instead on external third parties for ratings.

Overview of Chain Treasury Deposit Growth Data

• September 2024: US$15 billion
• September 2026: More than US$10 billion
• Two-year growth rate: 567%

Morpho Agreement: A few institutions control the flow of tens of billions of dollars

Morpho, one of the largest lending agreements, allows anyone to create a lending market. However, its official documents also acknowledge that selecting, evaluating collateral and continuously monitoring risk in these markets requires expertise. As a result, independent bodies known as Curators emerged to carry out these tasks. The curator determines which lending markets the treasury has access to, what collateral it accepts, the maximum exposure for each position, and when to reallocate deposits. Although smart contracts are responsible for implementing strategies, the strategies themselves are designed by the physical company.

According to Morpho, the treasury assets managed by Steakhouse Financial alone have exceeded US$2.2 billion, a significant increase from US$1.5 billion a year ago. In addition, distribution channels have also expanded to mainstream platforms: As of September 2026, deposits on Coinbase's USDC lending products and Robinhood Earn platform both exceeded US$500 million. Today, retail users using these apps are at the end of a complex chain that stretches from the fintech front end to curators and to loan agreements, most of which barely existed three years ago.

The risks of public ledger concealment: false prophets, bad debts and frozen withdrawals

Anyone can check the vault's balances and transaction records online. But the view of S & P Global Ratings is that this can only provide a snapshot of positions at a given moment, while restrictions on strategy and risk disclosure remain. Morpho's own risk documentation supports this view with specific details.

Oracle, the source of data on asset prices for the lending market, may overvalue collateral, resulting in loans being under-collateralized without triggering a liquidation mechanism. In Morpho Vault V2, bad debts in the underlying market will flow directly into the treasury value, and depositors will bear losses based on their holdings. If the borrower drains all available liquidity, withdrawal operations may temporarily stall. Roles such as owners, curators, configurators, and sentries have significant control over the treasury, so controlling the identity of these characters and their security practices has become core issues that depositors must focus on.

This information cannot be read directly from the blockchain browser and requires a comprehensive judgment of personnel, collateral and emergency plans, which is an area that rating agencies have always been good at.

How S & P scores vaults: Six factors and the role of "people"

S & P evaluated six factors and the results were expressed in a letter symbol scale with the suffix "(v)", where AAA(v) represents the relatively lowest impairment risk. The assessment is not a credit rating, and Standard & Poor's also made it clear that it does not measure the treasury's ability to fulfill payment obligations, nor does it evaluate whether the yield is attractive, but rather ranks the relative likelihood of impairment of depositors 'positions. Readers who mistakenly believe that AAA(v) is equivalent to AAA bond ratings are misunderstanding the system.

Detailed explanation of Vault Risk assessment elements

1. Portfolio Credit Quality

involves assets held by the treasury and risks in the lending market. (Financial factors)

2. Liquidity mismatch

refers to the risk that a depositor can successfully withdraw funds during the loan period. (Financial factors)

3. Curator Risk

Managers 'ability and willingness to maintain treasury risk appetite. (Human factors)

4. Blockchain Risk

Vulnerability of the underlying network. (Technical factors)

5. Protocol Risk

Weaknesses in lending agreements that receive assets. (Technical factors)

6. Security and Governance

Smart contract security, controls and management rights. (Technical factors)

The logic behind the strategic acquisition: Kaiko's transaction with OpenZeppelin

According to statistics from S & P Global Ratings, OpenZeppelin's contracts have supported more than US$37 trillion in value transfers, and the company has completed more than 900 security projects. S & P said the acquisition will expand its influence in the field of on-chain technology risk and support new security assessment services. Less than three weeks later, S & P released a methodology in which protocol, blockchain, security and governance risks accounted for half of the assessment factors. Traditional institutions mainly assess credit worthiness, while on-chain products add additional collateral, curators, agreements, contracts and cyber risks. S & P is covering every risk dimension through acquisitions or self-building capabilities.

Changes brought about by risk grading: Behind the 11% and 5% yields

DeFi users have long tended to choose products with high headline yields. A vault that pays 11% yields looks better than one that pays 5% yields until depositors learn that the former accepts illiquid collateral, runs stricter clearing thresholds, and gives curators greater discretion. Because S & P's assessment deliberately does not involve yields, it can be tied to market interest rates, allowing investors to make routine comparisons: that is, between returns and standardized measures of risk.

Institutional investors will be the first to benefit, as many institutions cannot hold instruments without an independent risk opinion on file. Curators face different pressures. Agencies that manage billions of dollars will face their first competitive and disciplinary scores with competitors. Financial technology platforms that distribute vaults to retail users also have reasons to prioritize products with evaluation results.

Standard & Poor's handling of Sky Protocol shows the severity of its scoring. On October 1, Standard & Poor's maintained Sky's B-rating, which is in the deeply speculative region, citing concentrated governance, insufficient capitalization and increased ecosystem complexity. Sky is one of the oldest and largest projects in the DeFi space. Treasury curators who want to score at the top of level (v) will be judged by the same analysts for similar weaknesses.